CVE-2026-107744 in LearnPress Plugin
Summary
by MITRE • 10/17/2026
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The LearnPress plugin for WordPress is a widely utilized Learning Management System solution that enables users to create, manage, and sell online courses directly within their WordPress environments. While this functionality provides significant value to educators and institutions, the software has historically been susceptible to security flaws due to complex interactions between user roles and administrative endpoints. In versions up through 4.4.10, a critical authorization bypass vulnerability exists that undermines the fundamental access control mechanisms of the platform. This flaw stems from insufficient verification processes when handling specific API requests or AJAX actions associated with course management features. The core issue lies in the failure to properly validate whether the initiating user possesses the requisite privileges for the requested operation, allowing lower-privileged accounts to execute functions intended exclusively for higher-level administrators or developers.
This vulnerability specifically impacts authenticated attackers who hold subscriber-level access and above within the WordPress ecosystem. Although these users are not typically granted administrative rights, they can exploit the authorization bypass to interact with internal endpoints that should be restricted. The most severe consequence of this flaw is the ability to perform user enumeration attacks against the entire site roster. By leveraging the search response functionality as an oracle, attackers can systematically extract sensitive information about any WordPress account on the platform. This includes not only public profile data but also private details such as full email addresses for all users, including those with administrator privileges. The extraction process is conducted character-by-character, which allows the attacker to bypass potential rate limiting or detection mechanisms that might trigger if large volumes of data were requested simultaneously.
The technical mechanism behind this exploitation involves manipulating search parameters in a way that causes the application to return different responses based on whether specific characters match those found in user_login and user_email database columns. This technique, often referred to as blind SQL injection via boolean-based oracle or time-based extraction depending on implementation details, allows for precise data reconstruction without direct access to the underlying database. The attacker sends a series of crafted requests containing partial strings and observes the server's response structure or status codes to deduce the next character in the target username or email address. This method is particularly dangerous because it operates within the bounds of legitimate application functionality, making it difficult for standard web application firewalls to distinguish between normal user search activity and malicious enumeration attempts.
The operational impact of this vulnerability extends beyond simple data leakage. The exposure of full email addresses for all users, including administrators, facilitates targeted phishing campaigns known as spear-phishing attacks. Attackers can craft highly convincing emails that appear to originate from trusted sources within the organization or educational institution, significantly increasing the likelihood of successful credential theft. Furthermore, knowledge of specific usernames and their associated roles allows attackers to prioritize brute-force efforts against high-value targets such as site administrators. Once administrative credentials are compromised through these auxiliary attacks, the attacker gains full control over the WordPress installation, enabling them to install malicious plugins, deface the website, or pivot into other systems within the network infrastructure.
From a classification perspective, this vulnerability aligns with CWE-285, which describes Improper Authorization, as the application fails to enforce proper access controls for critical functions. Additionally, the exploitation technique mirrors tactics found in the MITRE ATT&CK framework under T1078, Valid Accounts, and potentially T1003, OS Credential Dumping if combined with other exploits, though primarily it represents a data exfiltration vector via T1504 or similar enumeration techniques. The ability to enumerate users by character is also reminiscent of CWE-209, which involves the generation of error messages that contain sensitive information, although here the leakage is more subtle and relies on response differentiation rather than explicit error dumps.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The most effective solution is to upgrade the LearnPress plugin to a version later than 4.4.10 where this authorization bypass has been patched by the developers. Organizations should verify that their WordPress installations are fully updated, including core software and all active plugins, as outdated components often serve as entry points for broader compromises. In environments where immediate patching is not feasible due to compatibility concerns, administrators can implement temporary mitigations such as restricting access to specific AJAX endpoints via web application firewall rules or custom code snippets that enforce stricter role-based checks before processing search requests. Additionally, enabling two-factor authentication for all user accounts, particularly those with elevated privileges, adds a critical layer of defense against credential theft resulting from this enumeration vulnerability. Regular security audits and penetration testing should be conducted to identify similar authorization flaws in other plugins and themes used within the WordPress ecosystem.